diff --git a/cmd/clairctl/clair/analyze.go b/cmd/clairctl/clair/analyze.go
index 5186c45f..cea2bd1a 100644
--- a/cmd/clairctl/clair/analyze.go
+++ b/cmd/clairctl/clair/analyze.go
@@ -47,11 +47,12 @@ func analyzeLayer(id string) (v1.LayerEnvelope, error) {
 
 	lURI := fmt.Sprintf("%v/layers/%v?vulnerabilities", uri, id)
 	response, err := http.Get(lURI)
+	defer response.Body.Close()
+
 	if err != nil {
 		return v1.LayerEnvelope{}, fmt.Errorf("analysing layer %v: %v", id, err)
 	}
 
-	defer response.Body.Close()
 	var analysis v1.LayerEnvelope
 	err = json.NewDecoder(response.Body).Decode(&analysis)
 	if err != nil {
diff --git a/cmd/clairctl/clair/health.go b/cmd/clairctl/clair/health.go
index 565cff37..87e05c59 100644
--- a/cmd/clairctl/clair/health.go
+++ b/cmd/clairctl/clair/health.go
@@ -10,11 +10,12 @@ import (
 func IsHealthy() bool {
 	logrus.Debugln("requesting health on: " + healthURI)
 	response, err := http.Get(healthURI)
+	defer response.Body.Close()
+
 	if err != nil {
 		logrus.Errorf("requesting Clair health: %v", err)
 		return false
 	}
-	defer response.Body.Close()
 
 	if response.StatusCode != http.StatusOK {
 		return false
diff --git a/cmd/clairctl/clair/push.go b/cmd/clairctl/clair/push.go
index 93d92e99..878dca57 100644
--- a/cmd/clairctl/clair/push.go
+++ b/cmd/clairctl/clair/push.go
@@ -90,10 +90,11 @@ func pushLayer(layer v1.LayerEnvelope) error {
 	request.Header.Set("Content-Type", "application/json")
 
 	response, err := (&http.Client{}).Do(request)
+	defer response.Body.Close()
+
 	if err != nil {
 		return fmt.Errorf("pushing layer to clair: %v", err)
 	}
-	defer response.Body.Close()
 
 	if response.StatusCode != 201 {
 		if response.StatusCode == 422 {
diff --git a/cmd/clairctl/clair/versions.go b/cmd/clairctl/clair/versions.go
index 0942663e..51b7a540 100644
--- a/cmd/clairctl/clair/versions.go
+++ b/cmd/clairctl/clair/versions.go
@@ -9,11 +9,11 @@ import (
 func Versions() (interface{}, error) {
 	Config()
 	response, err := http.Get(uri + "/versions")
+	defer response.Body.Close()
 
 	if err != nil {
 		return nil, fmt.Errorf("requesting Clair version: %v", err)
 	}
-	defer response.Body.Close()
 	var versionBody interface{}
 	err = json.NewDecoder(response.Body).Decode(&versionBody)
 	if err != nil {
diff --git a/cmd/clairctl/docker/dockercli/dockercli.go b/cmd/clairctl/docker/dockercli/dockercli.go
index 4e8f525d..167b4322 100644
--- a/cmd/clairctl/docker/dockercli/dockercli.go
+++ b/cmd/clairctl/docker/dockercli/dockercli.go
@@ -65,15 +65,16 @@ func save(imageName string) (schema1.SignedManifest, error) {
 
 	// open output file
 	fo, err := os.Create(path + "/output.tar")
-	if err != nil {
-		return schema1.SignedManifest{}, err
-	}
 	// close fo on exit and check for its returned error
 	defer func() {
 		if err := fo.Close(); err != nil {
 			panic(err)
 		}
 	}()
+
+	if err != nil {
+		return schema1.SignedManifest{}, err
+	}
 	// make a write buffer
 	w := bufio.NewWriter(fo)
 
@@ -99,10 +100,11 @@ func save(imageName string) (schema1.SignedManifest, error) {
 
 func historyFromManifest(path string) (schema1.SignedManifest, error) {
 	mf, err := os.Open(path + "/manifest.json")
+	defer mf.Close()
+
 	if err != nil {
 		return schema1.SignedManifest{}, err
 	}
-	defer mf.Close()
 
 	// https://github.com/docker/docker/blob/master/image/tarexport/tarexport.go#L17
 	type manifestItem struct {
@@ -160,10 +162,11 @@ func historyFromCommand(imageName string) (schema1.SignedManifest, error) {
 func openAndUntar(name, dst string) error {
 	var rd io.Reader
 	f, err := os.Open(name)
+	defer f.Close()
+
 	if err != nil {
 		return err
 	}
-	defer f.Close()
 	rd = f
 	if strings.HasSuffix(name, ".gz") || strings.HasSuffix(name, ".tgz") {
 		gr, err := gzip.NewReader(f)
diff --git a/cmd/clairctl/docker/dockerdist/auth.go b/cmd/clairctl/docker/dockerdist/auth.go
index d2dcb2af..78b0d2bb 100644
--- a/cmd/clairctl/docker/dockerdist/auth.go
+++ b/cmd/clairctl/docker/dockerdist/auth.go
@@ -52,6 +52,7 @@ func AuthenticateResponse(client *http.Client, dockerResponse *http.Response, re
 	req.SetBasicAuth(authConfig.Username, authConfig.Password)
 
 	response, err := client.Do(req)
+	defer response.Body.Close()
 
 	if err != nil {
 		return err
@@ -65,7 +66,6 @@ func AuthenticateResponse(client *http.Client, dockerResponse *http.Response, re
 		return fmt.Errorf("authentication server response: %v - %v", response.StatusCode, response.Status)
 	}
 
-	defer response.Body.Close()
 	type token struct {
 		Value string `json:"token"`
 	}